BTD - PROCEXP152.SYS - Vulnerable Driver Loaded

[Panagiss]

Cortex blocked driver PROCEXP152.SYS from being loaded (rule: sync.vulnerable_driver_by_original_name_loaded_procexp)
The thing it that this is a signed microsoft driver and it's kind of a known situation for many other vendors.

Links: Process Explorer - ProcExp152.sys Driver Flagged As Vulnerable - Microsoft Q&A , SentinelOne annoyance! : r/sysadmin (reddit.com)

Does anyone seen this in Cortex before? What it's the best thing to do?

Thanks

[afurze · Accepted solution]

Hi Panagiss,

Cortex XDR is indicating that this is a vulnerable driver, not that it is not a legitimate driver (we're not disputing that it's signed by MS).  A common tactic used by attackers is to take advantage of highly trusted binaries which are vulnerable to abuse to perform actions like killing EDR tools.  There are many examples of executables which are vulnerable to misuse, including older versions of the process explorer binary.  To prevent misuse, Cortex XDR blocks loading of vulnerable versions of this executable by default.

If you want to allow this driver to be loaded in your environment, you can create a Disable Prevention Rule and (optionally) an Alert Exclusion to allow the driver to be loaded and suppress associated alerts from the console.  Keep in mind that this will create a risk for your organization as attackers could exploit this driver to kill Cortex XDR on the endpoint they have gained access to.